What is the CVSS score of EUVD-2026-12327?

EUVD-2026-12327 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for EUVD-2026-12327?

Yes, a public proof-of-concept exploit is available for EUVD-2026-12327. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-12327?

Within 24 hours: Identify all D-Link NAS devices in your environment and restrict network access to the CGI management interface to authorized administrators only. Within 7 days: Isolate affected NAS devices to a segmented network if they contain sensitive data, review access logs for suspicious activity, and contact D-Link support for patch timelines. Within 30 days: Develop a remediation plan including device replacement, upgrade to patched firmware versions when available, or decommissioning of unsupported models.

Dnr 202l EUVD-2026-12327

| CVE-2026-4213 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-16 VulDB

Buffer Overflow D-Link Stack Overflow Dnr 202l Dnr 322l Dnr 326 Dns 1100 4 Dns 120 Dns 1200 05 Dns 1550 04 Dns 315l Dns 320 Dns 320l Dns 320lw Dns 321 Dns 323 Dns 325 Dns 326 Dns 327l Dns 340l Dns 343 Dns 345 Dns 726 4 D-Link

8.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate to D-Link NAS web interface
Exploit

Send crafted request to /cgi-bin/gui_mgr.cgi
Execution

Trigger stack-based buffer overflow in cgi_myfavorite_del_user or cgi_myfavorite_verify
Impact

Execute arbitrary code with device privileges

Vulnerability Assessment

Weakness	CWE CWE-121 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Stack buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Valid user credentials required for authentication to D-Link NAS web interface. Vulnerable models: DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04 with firmware before 20260205.
Impact	This represents a high real-world risk based on multiple factors: CVSS 8.8 (High) with network attack vector requiring only low privileges and no user interaction. The CVSS vector shows E:P (Proof-of-concept exists) confirming exploitability. While not currently in CISA KEV, the public POC availability significantly increases risk. The vulnerability is automatable (AV:N/AC:L) and has high technical impact (C:H/I:H/A:H). Authentication requirement (PR:L) provides minimal protection as many NAS devices use weak/default credentials. This is a priority patch given the combination of public exploit, network accessibility, and critical data typically stored on NAS devices.
Exploit ScenarioDerived	An attacker with valid credentials (potentially default or weak passwords common on NAS devices) can remotely send specially crafted requests to the /cgi-bin/gui_mgr.cgi endpoint, triggering the buffer overflow in the favorite user management functions. This allows arbitrary code execution with the privileges of the CGI process, potentially leading to full device compromise, data theft, or use as a pivot point into the network. The public POC (https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_163/163.md) provides working exploit code, making attacks trivial for even low-skilled adversaries.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Stack-based buffer overflow in D-Link DNS storage appliances (DNS-120, DNS-340L, DNS-1200-05 and others) through the /cgi-bin/gui_mgr.cgi endpoint allows remote authenticated attackers to achieve code execution. Public exploit code exists for this vulnerability, and no patch is currently available. Affected firmware versions are dated up to February 5, 2026.

RemediationAI

No official patches are currently available from D-Link. Immediate mitigations include: 1) Disable remote access to the device management interface, 2) Place devices behind a firewall blocking external access to the CGI interface, 3) Monitor for suspicious authentication attempts and CGI requests to /cgi-bin/gui_mgr.cgi, 4) Consider replacing end-of-life models with supported alternatives. Check D-Link support site for future firmware updates addressing this CVE.

Affected VersionsENISA

DNS-1550-04 20260205

DNR-322L 20260205

DNS-120 20260205

DNS-327L 20260205

DNS-1200-05 20260205

DNS-326 20260205

DNS-321 20260205

DNS-320LW 20260205

DNR-202L 20260205

DNS-320 20260205

DNS-345 20260205

DNR-326 20260205

DNS-1100-4 20260205

DNS-343 20260205

DNS-315L 20260205

DNS-320L 20260205

DNS-325 20260205

DNS-340L 20260205

DNS-726-4 20260205

DNS-323 20260205

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability (CWE-121: Stack-based Buffer Overflow) affects the CGI binary gui_mgr.cgi in D-Link NAS devices, specifically in functions that handle user favorite management. The affected products span 20 different D-Link NAS models including DNS-120, DNS-320 series, DNS-340L, DNR series, and enterprise models like DNS-1550-04. All versions up to firmware date 20260205 are vulnerable. Stack buffer overflows occur when input data exceeds allocated buffer space on the stack, potentially overwriting return addresses and enabling code execution.

Know when Dnr 202l gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

CVE Published

Mar 16, 2026 - 04:02 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This vulnerability affects the function cgi_myfavorite_del_user/cgi_myfavorite_verify of the file /cgi-bin/gui_mgr.cgi. Performing a manipulation results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.

Executive ViewAI

Why It Matters

D-Link NAS devices are vulnerable to a high-severity buffer overflow attack that allows authenticated users to take complete control of affected systems. Organizations using these devices face immediate risk of data theft, system compromise, and operational disruption, especially since working exploit code is publicly available and no patch currently exists.

Business Impact: Severe

Compensating Controls

Disable CGI management interface if not actively required; implement network segmentation to restrict access to NAS devices from untrusted networks; deploy WAF or reverse proxy rules to block requests to vulnerable CGI endpoints (cgi_myfavorite_del_user, cgi_myfavorite_verify); enforce strong authentication and monitor administrative access logs; disable remote management access and require VPN for any required administration; implement intrusion detection signatures for exploitation attempts.

Threat Intelligence Overview

EPSS Score

0.1%

Top 76% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Stack-based Buffer Overflow HIGH

A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.